Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The "email is authentication" pattern

rubenerd.com

Post reply on HN
Print view View original

241–250 of 474 posts

Re: The "email is authentication" pattern

#241

Post by hgomersall »

kfrzcode wrote: post #75
hgomersall wrote: post #23

Earlier quoted context omitted.

It's an interesting design problem to have panel of peers attest an individual's identity. It could be made fairly seamless if there was a common system in which a suitably distributed authentication secret could be recombined under instruction from the relevant party. Can it be made to work for normal humans? I daresay we have the ingenuity to design something...

The Decentralized Recovery (DeRec) Alliance has recently launched to solve this very problem. Dr. Leemon Baird gave a talk last year on how this works at a higher level [0]. The alliance is comprised of members from the Algorand, Hedera, Ripple crypto communities but the application of proper DeRec would be certainly applicable anywhere you have any type of secret; in fact I believe you can be a DeRec 'helper' right…

I came up with a similar general approach about 10 years ago, but lacked the time or inclination (and probably knowledge, frankly) so I'm very pleased this is being pursued.

Re: The "email is authentication" pattern

#242

Post by treflop »

It’s because password sucks.

You’re supposed to not reuse passwords, but then you don’t remember passwords.

So you use a password manager. Until more recently when phones and computers came with built-in password managers, no normal person was going to download a password manager.

But even when you use a password manager, sometimes it doesn’t recognize the form fields. Or it doesn’t show it because the domain is different. Sometimes it doesn’t save a new login. The website has no direct awareness of the password manager so it’s hit and miss.

So we created passkeys. Except it’s also hit and miss. Some sites only sometimes ask for them. No site explains what they are. Some sites ask for you to login with a passkey, which you wouldn’t have yet, but then don’t ask you to setup the passkey after logging in with a password, so you never set up a passkey.

Overall authentication is a disaster and my very fiery take is overly technical people who are out of touch with normal people design authentication.

Re: The "email is authentication" pattern

#243

Post by Too »

IggleSniggle wrote: post #144
j-bos wrote: post #139

Earlier quoted context omitted.

I don't know, we carried physical money for millenia. Humans managed that.

Physical money is physically recoverable after lost

For the system yes, a dropped coin eventually reenters the market and a burned bill can be reprinted again. Can't say the same about a crypto wallet. For an individual though, in both cases, a lost wallet is a lost wallet.

While an interesting difference to study, the average person is not going to care about the former case. They just don't want to keep their life savings in an asset as easy to loose as their pocket money.

Re: The "email is authentication" pattern

#244

Post by tasuki »

firesteelrain wrote: post #220
nick3443 wrote: post #213

Earlier quoted context omitted.

Maybe instead of a crypto brokerage holding your wallet, there can be a "key bank" which uses those more expensive methods of attestation and you can use it for recovery if you lose your key up to once per year or something. It would be like having your key written down in a safety deposit box at a local or regional bank.

This is the same problem that you run into with secret zero and commonly discussed in context of HashiCorp Vault. At some point you need to store the unlock keys then you need another repository under RBAC to protect that repository. They say to print out the keys and store them offline on paper but how many own a Class 5 safe ?

How many own a lot of books? Just... pick one.

Re: The "email is authentication" pattern

#245

Post by tsimionescu »

SAI_Peregrinus wrote: post #116
candiddevmike wrote: post #29

Earlier quoted context omitted.

Government provided digital IDs would solve a lot of this. Yes, they may have their own problems, but outsourcing the action of identifying individuals to the government seems valuable and less prone to "lock outs" like Google and friends.

My wife works in a city clerk's office. They provide (among other things) vital records services for the city. Like getting birth certificates. To get a birth certificate, you must provide government photo ID with a name matching that of one of the names on the certificate you're trying to get . So you can get your own, or your child's, but not some random other person's. Lots of people were born before RealID driver…

These things can be solved too, but in a more complicated process. Typically some lawyers and a judge need to get involved, get some people to testify that you are this same person, and you will be issued new ID.

Re: The "email is authentication" pattern

#246

Post by Too »

dogcomplex wrote: post #21

At this point why not just pass a one-time url link to your email address, and have it be a single click to login? Have it expire within 10 mins if not used, and be one-time use disposable. Still, anyone who has the link initially should be able to login with your account - but it's only accessible from your email. Obliterates all sense of security beyond the email account itself, but that's where we're at anyway. Do…

At that point you might as well go all in on single sign on. 95% of all users are going to be on gmail, outlook or apple anyway. Better to have a "sign in with google" button rather than "send a link to your (g)mail". They can track you either way.

Re: The "email is authentication" pattern

#247

Post by grey-area »

nick3443 wrote: post #213
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

Maybe instead of a crypto brokerage holding your wallet, there can be a "key bank" which uses those more expensive methods of attestation and you can use it for recovery if you lose your key up to once per year or something. It would be like having your key written down in a safety deposit box at a local or regional bank.

Maybe the key bank could hold your digital money as well. Then we wouldn’t need a blockchain and your transactions could be instant, free, private and reversible.

Re: The "email is authentication" pattern

#248

Post by eesmith »

thaumasiotes wrote: post #216
simonw wrote: post #120

Earlier quoted context omitted.

> If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans. This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users.…

> This has been my single biggest argument against blockchain/cryptocurrency stuff for years: the "lose your key, lose your wallet" thing is fundamentally incompatible with real users. This would make currency fundamentally incompatible with real users. Reality says otherwise.

Except reality isn't so ... digital.

In reality I've found a lost wallet and helped return it to its owner. At least twice, actually. Both times because there was an identifying name in the wallet.

Then there's the time as a kid when we found $60 on the floor at a department store, and turned it over to lost&found. I remember it because the store had a policy that if cash hadn't been claimed for a month, then the person who turned it in got it. Which we did.

Re: The "email is authentication" pattern

#249

Post by palsecam »

aborsy wrote: post #202
thbb123 wrote: post #185

Earlier quoted context omitted.

The french postal services does that and includes a digital wallet and cloud repository.for instance, my paycheck certificates are delivered on this wallet. Besides, the french administration is providing its own global scheme for online authentication. Right now it works for all public services, but it is also open to all willing businesses. It makes it also very easy to control tightly what kind of information is d…

What are the names of these services, to see how they work, their recovery process and abuse prevention?

https://www.laPoste.fr/digiposte (digital safe) & https://laPoste.net/accueil (e-mail); offered by the postal services.

https://FranceConnect.gouv.fr/ is the online auth provided by the administration.

Re: The "email is authentication" pattern

#250

Post by lelanthran »

MrGilbert wrote: post #77

Interestingly enough, that is the login flow Figma is using with my account. I provide my email address, and get an email that contains a linkt to log me in. I remember having seen this idea at other places before. I don't really like it, because for me, using a password manager makes everything already quite convenient.

> I don't really like it, because for me, using a password manager makes everything already quite convenient.

How many people do you think use password managers? 1 in a 100? 1 in a thousand? Looking at the user counts for all the major password managers combined, the number looks more like 1 in a few dozen million.

We're a demographic that is smaller than the demographic of blind users. As a group, we're not even a rounding error. It makes no sense to optimise our group's workflow when the resources could be diverted towards making a better product.

After all, it's not like they lock out password-manager users completely.

Post reply on HN